libheif vulnerabilities and fixes

Recent CVEs affecting libheif, with upgrade or downgrade steps. 7 tracked.

libheif has 7 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 7. Most recent: 2026-07-22. Highest priority: CVE-2026-47247 (score 46/100).

• CVE-2026-47247 HIGH 7.5 UPGRADE libheif is a HEIF and AVIF file format decoder and encoder
• CVE-2026-47178 MEDIUM 6.1 UPGRADE libheif is a HEIF and AVIF file format decoder and encoder
• CVE-2026-47251 MEDIUM 6.1 UPGRADE libheif is a HEIF and AVIF file format decoder and encoder
• CVE-2026-47254 MEDIUM 6.1 UPGRADE libheif is a HEIF and AVIF file format decoder and encoder
• CVE-2026-47709 MEDIUM 5.5 UPGRADE libheif is a HEIF and AVIF file format decoder and encoder
• CVE-2026-47714 MEDIUM 6.1 UPGRADE libheif is a HEIF and AVIF file format decoder and encoder
• CVE-2026-48029 HIGH 7.1 UPGRADE libheif is a HEIF and AVIF file format decoder and encoder

FAQ

How do I fix libheif vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is libheif being exploited right now?

None of the tracked libheif CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which libheif CVE should I patch first?

CVE-2026-47247 currently ranks highest (46/100): libheif is a HEIF and AVIF file format decoder and encoder.

← Back to latest CVEs